OpenAFS Security Advisories

The following are overviews of security advisories issued by the OpenAFS Project regarding known security problems in OpenAFS and its components. Each overview includes a summary of the problem, a link to the full text of the advisory. When they are available, patches are also included. At the end of this document is a table of all OpenAFS security advisories.

If you want to report security problems or issues with OpenAFS, you may send mail to the OpenAFS security officer at security@openafs.org. When sending sensitive information, we ask that you encrypt it with PGP.

OPENAFS-SA-2018-003 - denial of service due to excess resource consumption

Several data types used as RPC input variables were implemented as unbounded array types, limited only by the inherent 32-bit length field to 4GB. An unauthenticated attacker could send, or claim to send, large input values and consume server resources waiting for those inputs, denying service to other valid connections.

Several RPC server routines did not fully initialize their output variables before returning, leaking memory contents from both the stack and the heap. Because the OpenAFS cache manager functions as an Rx server for the AFSCB service, clients are also susceptible to information leakage.

The backup tape controller process accepts incoming RPCs but does not require (or allow for) authentication of those RPCs. Handling those RPCs results in operations being performed with administrator credentials, including dumping/restoring volume contents and manipulating the backup database.

Due to insufficient validation of transport parameters received in unauthenticated ack packets, Rx participants can be coerced into using very small MTU values that become negative when converted into effective MTU values. Subsequent usage as an unsigned packet size produces a very large packet size, that subsequently triggers an assertion failure.

Due to insufficient clearing of directory entries and internal buffers, directory information may be leaked over the network, as well as in cache manager cache partitions and fileserver vice partitions. This information may include file and directory names, vnode number and uniqueid, and may include information from other directories or volumes for which the user is not authorized.

Several structures used as RPC arguments contain a mask field that indicates which other fields should be processed by the server. In some cases, fields not not indicated in the mask were transmitted over the network without being written to, exposing the previous contents of that memory. Both kernel stack and userspace stack data can be leaked.

Access checking for the creation of new entries in the PRDB was performed in multiple steps. For requests coming from foreign users, the creator ID was replaced with the ID of system:administrators after the first round of checks, letting requests from foreign users bypass most other access control checks and create groups as if they were an administrator.

The 1.6.8 release of the OpenAFS fileserver and dafileserver processes introduced a security vulnerability in the host package due to the use of uninitialized memory allocations from the process heap.

An attacker with the ability to connect to an OpenAFS fileserver over the network can trigger the use of uninitialized memory and, potentially, execution of arbitrary code with the privileges of the fileserver process.

OPENAFS-SA-2014-001 - Denial of service attack against OpenAFS fileserver processes

The small size of the DES key space permits an attacker to brute force a cell's service key and then forge traffic from any user within the cell. The key space search can be performed in under 1 day at a cost of around $100 using publicly available services.

By carefully crafting an ACL entry an attacker may overflow fixed length buffers within the OpenAFS fileserver, crashing the fileserver, and potentially permitting the execution of arbitrary code. To perform the exploit, the attacker must already have permissions to create ACLs on the fileserver in question. This vulnerability is being tracked as CVE-2013-1794.

OPENAFS-SA-2011-001 - Denial of service attack against Rx server processes

An attacker with control of a client, or the ability to forge RX packets, can crash a server of affected hosts. This vulnerability is being tracked as CVE-2011-0430.

Currently the advisory erroneously states 1.4.14 is vulnerable.

CVE-2011-0431, while correctly describing 1.4.14 as containing the fix for this issue, describes in its summary the release as broken. It is not. We recommend sites upgrade to 1.4.14; However, the impact of the issue is limited to a denial of service attack by a user with the ability to affect a lock of AFS though the client on a host.

OPENAFS-SA-2009-002 - Denial of service attack against Linux cache manager

AFS may pass an error code obtained from the fileserver directly to the Linux kernel, using a Linux mechanism that merges error codes and pointers into a single value. However, this mechanism is unable to distinguish certain error codes from pointers. When AFS returns a code of this type to the kernel, the kernel treats it as a pointer and attempts to dereference it. This causes a kernel panic, and results in a denial of service attack.

There are no known publicly-available exploits for this vulnerability at this time.

AFS's XDR data marshalling language permits the construction of arrays with a size constrained by the interface definition. The XDR decoding language will accept data from the server up to this maximum size, which in some cases is stored into a buffer allocated by the client. In several locations, the AFS client assumes that the server will never return more data than requested, and so allocates a buffer smaller than this maximum size. Whilst this causes no problems when communicating with valid servers, an attacker can return more data than expected, and overflow the client's buffer.

There are no known publicly-available exploits for this vulnerability at this time.

OPENAFS-SA-2007-003 - denial of service in OpenAFS fileserver

The AFS fileserver tracks client callbacks on files via a series of linked lists internally. When a client acquires a new callback or gives up an old one, these lists must be updated. Beginning in 1.3.50, a bulk disposal mechanism was added. Due to a failure to hold a lock, unsafe access to data could result in a crash. No data compromise is known.

There are no known publicly-available exploits for this vulnerability at this time.

OPENAFS-SA-2007-002 - OpenAFS for Windows clients denial of service vulnerability

OpenAFS for Windows installs a Network Provider module, afslogon.dll, which is loaded by the Windows Logon service, winlogon.exe. When MIT Kerberos for Windows is installed, afslogon.dll will attempt to perform operations that involve the Kerberos v5 libraries. Successful use of Kerberos v5 requires the ability to establish a krb5_context. Parsing errors in the Kerberos v5 configuration profile, krb5.ini, will prevent the successful creation of a krb5_context. afslogon.dll attempts to free a krb5_context whether or not it was successfully established. This produces a memory access error that in turn forces the Windows Logon Service to terminate unexpectedly and causes Microsoft Windows to halt.

There are no known publicly-available exploits for this vulnerability at this time.

Because AFS cache managers do not use authenticated connections for non-user-authenticated sessions, checks for cache coherency are done over an unprotected connection if they are not being done for an authenticated user. Because of this it is possible to spoof a false status for files in the cache.

The AFS cache manager on platforms which offer privilege based on file modes are vulnerable to such attacks.

There are no known publicly-available exploits for this vulnerability at this time.

There is a bug in the Rx RPC protocol, used by AFS, which can be exploited by an attacker to hijack arbitrary Rx connections. This allows the attacker to mount a denial of service attack by breaking arbitrary Rx connections. Additionally, unless encryption is used, such as rxkad mode crypt ("fs setcrypt on") and the user accessing files is authenticated (has valid tokens), the attacker can observe and modify the data being transferred.

The AFS cache manager and other AFS administrative clients (such as pts, fs, vos, etc) are vulnerable to these attacks. Vulnerable AFS servers allow connections from AFS cache managers to be hijacked, but not connections from the other AFS administrative clients (such as pts, fs, vos, etc).

There are no known publicly-available exploits for this vulnerability at this time.

A cryptographic weakness in version 4 of the Kerberos protocol allows an attacker to use a chosen-plaintext attack to impersonate any principal in a realm. OpenAFS kaserver implements version 4 of the Kerberos protocol, and therefore is vulnerable. An attacker that knows a shared cross-realm key between any remote realm and the local realm can impersonate any principal in the local realm to AFS database servers and file servers in the local cell, and other services in the local realm. An attacker that can create arbitrary principal names in a realm can also impersonate any principal in that realm.

If your realm has no shared keys, and does not allow users to create arbitrary principal names, you are not exposed to this vulnerability.

There are no known publicly-available exploits for this vulnerability at this time.

There is an integer overflow bug in the SUNRPC-derived RPC library used by OpenAFS that could be exploited to crash certain OpenAFS servers (volserver, vlserver, ptserver, buserver) or to obtain unauthorized root access to a host running one of these processes.

In addition, it is possible for a rogue server to attack certain administrative clients (vos, pts, backup, butc, rxstat), but only if certain RPC requests are made to the rogue server.

The OpenAFS fileserver and cache manager (client) are not vulnerable to these attacks. No exploits are presently known to be available for this vulnerability.